Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
This rule detects suspicious activities indicative of Phantom Stealer malware injecting into 'explorer.exe'. It looks for screen capture API calls originating from 'explorer.exe', the loading of GDI DLLs into 'explorer.exe', and 'explorer.exe' being spawned from unexpected parent processes, all of which are behaviors associated with Phantom Stealer.
Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.
Detects file access events where the powrprof.dll file is accessed within the Avast Software installation directory. This pattern may be indicative of DLL hijacking or unauthorized file interaction targeting components within the Avast security product structure.
Detects suspicious child processes spawned in a suspended state, indicative of process hollowing. The rule specifically targets legitimate Windows system processes (svchost.exe, explorer.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe, msiexec.exe, regsvr32.exe) when they are spawned by non-system parent processes originating from user-writable paths like AppData, Temp, Roaming, ProgramData, or Desktop. This behavior is commonly associated with malware like Remcos RAT.
This rule detects the creation of Azure DNS zones by callers who have no prior history of writing to DNS zones within a specified lookback period. This behavior can indicate an attempt at DNS zone takeover, as observed in campaigns like 'Borrowed Trust' or 'link99', where adversaries might create orphaned DNS zones to redirect traffic or host malicious content.
This rule detects instances where 'msiexec.exe' spawns 'cmd.exe' to execute a batch or command file (.bat or .cmd) located within the 'AppData\Roaming' directory. This behavior can be indicative of malicious activity, as adversaries often use msiexec.exe for proxy execution and drop malicious scripts in user-writable directories like AppData.
This rule detects various activities associated with the RustDesk remote access tool, including process execution, file staging (RustCustom.zip or rustdesk.exe by hash), firewall rule creation for RustDesk, and service installation related to RustDesk. Detection is based on process names, file names, SHA256 hashes, firewall rule names, and service names.
This rule detects instances where msiexec.exe, a legitimate Windows Installer utility, spawns discovery tools like wmic.exe or tasklist.exe. This behavior can be indicative of an adversary using msiexec.exe for proxy execution to gather system information, potentially bypassing security controls. The detection looks for wmic.exe or tasklist.exe being launched within a 2-minute window of msiexec.exe, with specific command-line arguments often used for process or system listing, and where msiexec.exe or cmd.exe is the initiating process or parent process.
Detects the creation of potentially malicious archive files (.zip, .iso, .img, .cab) in the Downloads folder, initiated by web browsers (Chrome, Edge, Firefox), where the initiating process's command line indicates a local file access (file:///), suggesting a Blob-to-Disk dropper technique often associated with AI-obfuscated phishing campaigns.
Detects the execution of a binary from the Linux shared memory directory /dev/shm.
This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.
This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
This rule detects potentially malicious process chains: first, where common Windows utilities like explorer.exe, mshta.exe, or cmd.exe spawn PowerShell with suspicious arguments (hidden windows, execution policy bypass, or encoded commands). Second, it detects when Node.js is executed from user-writable directories (Temp, AppData, Downloads, ProgramData) by PowerShell or explorer.exe, excluding legitimate nodejs installation paths. These patterns are often associated with dropper behavior or initial access stages.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects instances of PerfWatson2.exe executing from non-standard locations (outside of known Visual Studio directories) or matching known malicious file hashes/versions. This behavior is indicative of masquerading, where a malicious binary attempts to mimic legitimate Microsoft software.
Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
Page 364 of 864